19bcec8cb5
Sometimes we want to drop all traffic from certain IP addresses. Add a block inside our iptabeles rules before the ACCEPT rules which will DROP traffic from matching IPs. I did not use the existing generic add a rule block because that comes after the accepts for specific public ports. We may wish to block traffic going to a valid port which needs to happen earlier in the ruleset. Note that the test all group_vars file is updated to block ipv4 and ipv6 documentation ranges so that we can see the doesn't break the rest of our iptables rulesets when applied. Finally we edit the infra-prod-base job to trigger when playbooks/roles/iptables is edited. The base.yaml playbook runs this role in addition to the roles in playbooks/roles/base/ so we should trigger the job when iptables updates. Otherwise we will end up waiting for daily runs to update iptables rules. Change-Id: I8fea56b8f55e86841701212fd8a23b544b160ea3
49 lines
1.8 KiB
Django/Jinja
49 lines
1.8 KiB
Django/Jinja
*filter
|
|
:INPUT ACCEPT [0:0]
|
|
:FORWARD DROP [0:0]
|
|
:OUTPUT ACCEPT [0:0]
|
|
:openstack-INPUT - [0:0]
|
|
:openstack-OUTPUT - [0:0]
|
|
-A INPUT -j openstack-INPUT
|
|
-A openstack-INPUT -i lo -j ACCEPT
|
|
-A openstack-INPUT -p icmpv6 -j ACCEPT
|
|
-A openstack-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
# SSH from anywhere
|
|
-A openstack-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
|
|
# Lists of hosts we want to block
|
|
{% for host in iptables_disallowed_hosts_v6 -%}
|
|
-A openstack-INPUT -s {{ host }} -j DROP
|
|
{% endfor -%}
|
|
# Public TCP ports
|
|
{% for port in iptables_public_tcp_ports -%}
|
|
-A openstack-INPUT -m state --state NEW -m tcp -p tcp --dport {{ port }} -j ACCEPT
|
|
{% endfor -%}
|
|
# Public UDP ports
|
|
{% for port in iptables_public_udp_ports -%}
|
|
-A openstack-INPUT -m udp -p udp --dport {{ port }} -j ACCEPT
|
|
{% endfor -%}
|
|
# Per-host ingress rules
|
|
{% for rule in iptables_rules_v6 -%}
|
|
-A openstack-INPUT {{ rule }}
|
|
{% endfor -%}
|
|
{% for host in iptables_allowed_hosts -%}
|
|
{% for addr in host.hostname | dns_aaaa -%}
|
|
-A openstack-INPUT {% if host.protocol == 'tcp' %}-m state --state NEW {% endif %}-m {{ host.protocol }} -p {{ host.protocol }} -s {{ addr }} --dport {{ host.port }} -j ACCEPT
|
|
{% endfor -%}
|
|
{% endfor -%}
|
|
{% for group in iptables_allowed_groups -%}
|
|
{% for host in groups.get(group.group, []) -%}
|
|
{% if hostvars[host]['public_v6'] | default(False) -%}
|
|
-A openstack-INPUT {% if group.protocol == 'tcp' %}-m state --state NEW {% endif %} -m {{ group.protocol }} -p {{ group.protocol }} -s {{ hostvars[host]['public_v6'] }} --dport {{ group.port }} -j ACCEPT
|
|
{% endif -%}
|
|
{% endfor -%}
|
|
{% endfor -%}
|
|
-A openstack-INPUT -j REJECT --reject-with icmp6-adm-prohibited
|
|
# Egress filtering
|
|
-A OUTPUT -j openstack-OUTPUT
|
|
# Per-host egress rules
|
|
{% for rule in iptables_egress_rules_v6 -%}
|
|
-A openstack-OUTPUT {{ rule }}
|
|
{% endfor -%}
|
|
COMMIT
|